Medium WID-SEC-2023-1193 7 CVEs

Red Hat Single Sign On: Mehrere Schwachstellen

Published May 10, 2023 · Updated Jul 10, 2025 · Revision 10 · de-DE

Vendor: Hitachi Vendor: Red Hat Vendor: Ubuntu Product: Enterprise Linux Product: JBoss A-MQ Product: Linux Product: Ops Center Product: Single Sign On Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder Sicherheitsvorkehrungen zu umgehen.

Product

Red Hat Single Sign-On ist ein eigenständiger Server, basierend auf dem Keycloak Projekt.

Vulnerabilities 7

Critical 9.8

CVE-2022-4492

Undertow client not checking server identity presented by server certificate in https connections

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

undertow undertow io.undertow:undertow-core Debian Ubuntu Maven

Feb 23, 2023
High 7.5

CVE-2021-0341

Square OkHttp can accept the wrong certificate

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction…

com.squareup.okhttp3:okhttp Android Maven

Feb 10, 2021
Medium 6.5

CVE-2022-38752

DoS in SnakeYAML

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Wolfi Maven

Sep 5, 2022
Medium 5.8

CVE-2022-41854

Stack Overflow in Snakeyaml

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may suppor…

SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Wolfi Maven

Nov 11, 2022
Medium 5.5

CVE-2022-45787

Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j…

Apache Software Foundation Apache James Mime4J org.apache.james:apache-mime4j-storage Maven

Jan 6, 2023
Medium 5.5

CVE-2023-0482 Public exploit

Insecure Temporary File in RESTEasy

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

resteasy resteasy3.0 resteasy3.0 org.jboss.resteasy:resteasy-core Debian Ubuntu Maven

Feb 17, 2023
Medium 5.3

CVE-2022-41881

HAProxyMessageDecoder Stack Exhaustion DoS

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

netty netty netty netty Debian Ubuntu Maven

Dec 12, 2022

Revision history

2025-07-10 #10
Neue Updates von Ubuntu aufgenommen
2025-06-24 #9
Neue Updates von Red Hat aufgenommen
2024-03-17 #8
Neue Updates von Red Hat aufgenommen
2023-10-03 #7
Neue Updates von HITACHI aufgenommen
2023-09-14 #6
Neue Updates von Red Hat aufgenommen
2023-09-05 #5
Neue Updates von Red Hat aufgenommen
2023-06-29 #4
Neue Updates von Red Hat aufgenommen
2023-06-27 #3
Neue Updates von Red Hat aufgenommen
2023-05-18 #2
Neue Updates von Red Hat aufgenommen
2023-05-10 #1
Initiale Fassung

References

Red Hat Security Advisory RHSA-2023:2705 vom 2023-05-10
https://access.redhat.com/errata/RHSA-2023:2705
Red Hat Security Advisory RHSA-2023:2706 vom 2023-05-10
https://access.redhat.com/errata/RHSA-2023:2706
Red Hat Security Advisory RHSA-2023:2707 vom 2023-05-10
https://access.redhat.com/errata/RHSA-2023:2707
Red Hat Security Advisory RHSA-2023:2710 vom 2023-05-10
https://access.redhat.com/errata/RHSA-2023:2710
Red Hat Security Advisory RHSA-2023:2713 vom 2023-05-10
https://access.redhat.com/errata/RHSA-2023:2713
Red Hat Security Advisory RHSA-2023:3223 vom 2023-05-18
https://access.redhat.com/errata/RHSA-2023:3223
Red Hat Security Advisory RHSA-2023:3815 vom 2023-06-27
https://access.redhat.com/errata/RHSA-2023:3815
Red Hat Security Advisory RHSA-2023:3813 vom 2023-06-27
https://access.redhat.com/errata/RHSA-2023:3813
Red Hat Security Advisory RHSA-2023:3809 vom 2023-06-29
https://access.redhat.com/errata/RHSA-2023:3809
Red Hat Security Advisory RHSA-2023:4983 vom 2023-09-05
https://access.redhat.com/errata/RHSA-2023:4983
Red Hat Security Advisory RHSA-2023:5165 vom 2023-09-14
https://access.redhat.com/errata/RHSA-2023:5165
Hitachi Vulnerability Information HITACHI-SEC-2023-143 vom 2023-10-03
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-143/index.html
Red Hat Security Advisory RHSA-2024:1353 vom 2024-03-18
https://access.redhat.com/errata/RHSA-2024:1353
Red Hat Security Advisory RHSA-2025:9582 vom 2025-06-25
https://access.redhat.com/errata/RHSA-2025:9582
Red Hat Security Advisory RHSA-2025:9583 vom 2025-06-25
https://access.redhat.com/errata/RHSA-2025:9583
Ubuntu Security Notice USN-7630-1 vom 2025-07-11
https://ubuntu.com/security/notices/USN-7630-1